can1357/oh-my-pi · error

Unsupported Codex Security coverage document

Error message

Unsupported Codex Security coverage document

What it means

The importer also validates coverage.json: it must declare documentType "codex-security.coverage" and schemaVersion "1.0". If not, the coverage document is unsupported and the whole bundle import fails.

Source

Thrown at packages/coding-agent/src/security/importers/codex-security.ts:203

	return coverage;
}

export async function importCodexSecurityBundle(
	bundleDirectory: string,
	options: CodexSecurityImportOptions,
): Promise<SecurityScanBundle> {
	const root = path.resolve(bundleDirectory);
	const manifest = await readJson<CodexManifest>(path.join(root, "scan-manifest.json"));
	const findingsDocument = await readJson<CodexFindingsDocument>(path.join(root, "findings.json"));
	const coverageDocument = await readJson<CodexCoverageDocument>(path.join(root, "coverage.json"));
	if (manifest.documentType !== "codex-security.scan-manifest" || manifest.schemaVersion !== "1.0") {
		throw new Error("Unsupported Codex Security scan manifest");
	}
	if (findingsDocument.documentType !== "codex-security.findings" || findingsDocument.schemaVersion !== "1.0") {
		throw new Error("Unsupported Codex Security findings document");
	}
	if (coverageDocument.documentType !== "codex-security.coverage" || coverageDocument.schemaVersion !== "1.0") {
		throw new Error("Unsupported Codex Security coverage document");
	}
	if (
		!manifest.scan?.id ||
		findingsDocument.scanId !== manifest.scan.id ||
		coverageDocument.scanId !== manifest.scan.id
	) {
		throw new Error("Codex Security bundle scan IDs do not agree");
	}
	const fixtureProvenance = await readJson<CodexFixtureProvenance>(path.join(root, "PROVENANCE.json")).catch(
		(): CodexFixtureProvenance => ({}),
	);
	const scanId = options.createScanId?.() ?? createSecurityScanId();
	const createdAt = options.createdAt ?? manifest.scan.startedAt ?? new Date().toISOString();
	const canonicalRoot = await fs.realpath(path.resolve(options.repositoryRoot));
	const producer: SecurityProducer = {
		kind: "codex-security-bundle",
		name: manifest.scan.producer?.name || "codex-security",
		vendor: "openai",

View on GitHub (pinned to 9690622007)

Solutions

1. Regenerate coverage.json so it declares documentType codex-security.coverage and schemaVersion 1.0
2. Rebuild the bundle from a single scan so all three documents share the same format generation
3. Confirm you are importing the correct directory and not one containing an older coverage.json

Example fix

// before (coverage.json)
{ "documentType": "coverage", "schemaVersion": "1.0" }
// after
{ "documentType": "codex-security.coverage", "schemaVersion": "1.0" }

const coverage = JSON.parse(await Bun.file(path.join(dir, "coverage.json")).text());
if (coverage.documentType !== "codex-security.coverage" || coverage.schemaVersion !== "1.0") {
  throw new Error(`Unsupported coverage document: ${coverage.documentType}/${coverage.schemaVersion}`);
}

function isSupportedCoverage(d: unknown): d is { documentType: "codex-security.coverage"; schemaVersion: "1.0" } {
  return typeof d === "object" && d !== null &&
    (d as any).documentType === "codex-security.coverage" && (d as any).schemaVersion === "1.0";
}

try {
  const bundle = await importCodexSecurityBundle(dir);
} catch (err) {
  if (err instanceof Error && err.message === "Unsupported Codex Security coverage document") {
    console.error("coverage.json envelope invalid — regenerate or clean the bundle directory");
  } else throw err;
}

When it happens

Trigger: importCodexSecurityBundle reads coverage.json whose documentType or schemaVersion does not match codex-security.coverage / 1.0.

Common situations: Coverage file from a newer generator version; stale coverage.json left in the bundle directory from a previous run with a different format; files copied from mixed sources.

Related errors

• Unsupported Codex Security scan manifest
• Unsupported Codex Security findings document
• Codex Security bundle locations must be repository-relative:
• Codex Security bundle scan IDs do not agree
• invalid glob `{pattern}`: {error}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/840058fbdbd86fd9. Report an issue: GitHub.